summaryrefslogtreecommitdiffstats
path: root/drivers/infiniband
diff options
context:
space:
mode:
authorMichal Kalderon <michal.kalderon@marvell.com>2019-11-18 17:06:45 +0200
committerJason Gunthorpe <jgg@mellanox.com>2019-11-19 16:15:36 -0400
commita25984f3baaa97079ce3e75c5a1d362155915a31 (patch)
tree62b12445e94ad571541f07f8125c46dc9dbc5ffb /drivers/infiniband
parent0acc637dacb6bf12a17c9ad0c41d9ff3696d8b05 (diff)
downloadlinux-a25984f3baaa97079ce3e75c5a1d362155915a31.tar.gz
linux-a25984f3baaa97079ce3e75c5a1d362155915a31.tar.bz2
linux-a25984f3baaa97079ce3e75c5a1d362155915a31.zip
RDMA/qedr: Fix null-pointer dereference when calling rdma_user_mmap_get_offset
When running against rdma-core that doesn't support doorbell recovery, the rdma_user_mmap_entry won't be allocated for doorbell recovery related mappings. We have a flag indicating whether rdma-core supports doorbell recovery or not which was used during initialization, however some cases didn't check that the rdma_user_mmap_entry exists before attempting to acquire it's offset. Fixes: 97f612509294 ("RDMA/qedr: Add doorbell overflow recovery support") Link: https://lore.kernel.org/r/20191118150645.26602-1-michal.kalderon@marvell.com Signed-off-by: Ariel Elior <ariel.elior@marvell.com> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r--drivers/infiniband/hw/qedr/verbs.c15
1 files changed, 10 insertions, 5 deletions
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 55b77d753d12..4cd292966aa9 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -683,7 +683,9 @@ static int qedr_copy_cq_uresp(struct qedr_dev *dev,
uresp.db_offset = db_offset;
uresp.icid = cq->icid;
- uresp.db_rec_addr = rdma_user_mmap_get_offset(cq->q.db_mmap_entry);
+ if (cq->q.db_mmap_entry)
+ uresp.db_rec_addr =
+ rdma_user_mmap_get_offset(cq->q.db_mmap_entry);
rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp));
if (rc)
@@ -1012,7 +1014,7 @@ err1:
if (udata) {
qedr_free_pbl(dev, &cq->q.pbl_info, cq->q.pbl_tbl);
ib_umem_release(cq->q.umem);
- if (ctx)
+ if (cq->q.db_mmap_entry)
rdma_user_mmap_entry_remove(cq->q.db_mmap_entry);
} else {
dev->ops->common->chain_free(dev->cdev, &cq->pbl);
@@ -1245,7 +1247,9 @@ static void qedr_copy_rq_uresp(struct qedr_dev *dev,
}
uresp->rq_icid = qp->icid;
- uresp->rq_db_rec_addr = rdma_user_mmap_get_offset(qp->urq.db_mmap_entry);
+ if (qp->urq.db_mmap_entry)
+ uresp->rq_db_rec_addr =
+ rdma_user_mmap_get_offset(qp->urq.db_mmap_entry);
}
static void qedr_copy_sq_uresp(struct qedr_dev *dev,
@@ -1260,8 +1264,9 @@ static void qedr_copy_sq_uresp(struct qedr_dev *dev,
else
uresp->sq_icid = qp->icid + 1;
- uresp->sq_db_rec_addr =
- rdma_user_mmap_get_offset(qp->usq.db_mmap_entry);
+ if (qp->usq.db_mmap_entry)
+ uresp->sq_db_rec_addr =
+ rdma_user_mmap_get_offset(qp->usq.db_mmap_entry);
}
static int qedr_copy_qp_uresp(struct qedr_dev *dev,